DVA-C02 Question 384
Single answerYou are developing a serverless application using AWS Lambda. The Lambda function processes data from an Amazon S3 bucket whenever a new object is uploaded. After processing, the function writes the results to a DynamoDB table. During testing, you notice that the Lambda function fails with a 'Permission Denied' error when trying to write to DynamoDB. What is the MOST likely cause of this issue, and how can you resolve it?
- A
The Lambda function's execution role does not have sufficient permissions to write to the DynamoDB table.
- B
The DynamoDB table's resource policy does not allow access to the Lambda function.
- C
The Lambda function is not subscribed to the correct Amazon S3 bucket event notification.
- D
The Amazon S3 bucket policy does not allow access to the Lambda function.
Show answer and explanation
Correct answer: A
Explanation
The error occurs because the Lambda function's execution role does not have sufficient permissions to write to the DynamoDB table. In AWS, a Lambda function executes using an IAM role, and the permissions for accessing AWS resources like DynamoDB are defined in the policy attached to that role. To resolve this issue, you need to add a policy to the Lambda function's execution role that allows appropriate actions (e.g., 'dynamodb:PutItem') on the DynamoDB table.
- A. Correct.
This is the correct answer. If the Lambda function's execution role does not have the appropriate permissions to write to the DynamoDB table, the function will fail with a 'Permission Denied' error. Adding the necessary permissions to the IAM role associated with the Lambda function will resolve the issue.
- B. Incorrect.
While DynamoDB supports resource policies, this is not the most common setup for granting access to a Lambda function. Typically, permissions for DynamoDB access are managed through the Lambda function's execution role.
- C. Incorrect.
This is unrelated to the error described. The event notification from the S3 bucket is used to trigger the Lambda function, but the issue here is specifically with writing to DynamoDB.
- D. Incorrect.
This is incorrect because the issue is not related to accessing the S3 bucket, but rather to writing to the DynamoDB table.